In this framework, we can understand backdoor attacks as choosing the optimal \(\Delta \)  directly based on a given rule (here via patch insertion onto training images with the target label \(y_i^\text{adv}\) ), whereas optimization-based methods such as [1]} optimize some approximation of the (intractable) full bilevel optimization problem. Witches' Brew [1]} approximately optimizes \(\Delta \)  by modifying training data so the gradient of the training objective is aligned with the gradient of the adversarial loss \(\mathcal {L} \left( F(x^t_i, \theta (\Delta )), y^\text{adv}_i\right)\) , using optimization methods based on adversarial literature [3]}, [4]}, [5]}.
